Home > Hardware, Linux > Xiaomi WiFi IP Cameras Hacked to Run RTSP Server, Disable Cloud Service

Xiaomi WiFi IP Cameras Hacked to Run RTSP Server, Disable Cloud Service

Xiaomi 720p and 1080p IP cameras include night vision, motion detection, WiFi connectivity, and can save videos locally, and send them to a cloud server in China for you to check your camera from anywhere. The 720p camera sells for about $50, while the 1080p camera goes for around $30 on GearBest and other websites, but comes with less IR LEDs and no optical zoom. [Update: The black version of the 720p camera goes for $29.99 on Amazon US]

Xiaomi-IP-CamerasThey works fine, but you need a specific mobile app to configure and control the camera, and if you’d rather not have the videos streamed to some server outside of your local network, github user “Fritz” has developed a set of scripts for the camera to disable cloud service, run a standard RTSP server, as well as HTTP and FTP servers on the camera.

He did his work on Yi Ants Camera (720p), but other members of the community have been helping, and some are currently working on supporting the cheaper 1080p model. The RSTP server is now working on the 1080p. However, everything is still working in progress, and you may want to join the fun on github, but if you want an easy to use SD card image this will take a little longer. The camera and corresponding hack are also being discussed on HotUKDeals.com.

Thanks to Rob for the tip.

  1. abc
    January 13th, 2017 at 12:54 | #1

    “There is no login and password and currently no way to set it.”

    Yeah, secure solution.

  2. SĂ©bastien
    January 13th, 2017 at 16:32 | #2

    The camera is in your LAN, security is less important, for WAN access a reverse proxy can secure it

  3. animtakhnet
    January 13th, 2017 at 16:51 | #3

    Does anybody know if the timezone problem has been fixed?

  4. Rob
    January 13th, 2017 at 17:13 | #4

    @cnxsoft – wow that was quick !

    @abc what is that related to specifically?

    @animtakhne this was mentioned in the 1080p hacking thread “@GB505 ntpdate is already available but there’s no zoneinfo. You need to specify a timezone-offset (from China I believe) in /etc/TZ. I’m working on a script to automate it.” if that’s what you mean.

    Personally I like the option of either running the official cloud/app based service or just locally as it gives people choice. For me I want to control the security of the devices on my network and stop them punching holes in my firewall out to services I have no control over. I can see these cameras being very popular.

  5. January 13th, 2017 at 17:44 | #5

    Maybe use “Modified” instead of “Hacked” next time, at first read, I had the impression those network cameras were hacked again for DDOS purposes 🙂

  6. camiel
    January 14th, 2017 at 08:16 | #6

    Or you can either set a static ip(lease) and block outgoing traffic lan->Wan

  7. ee
    January 16th, 2017 at 09:10 | #7

    zoobab :
    Maybe use “Modified” instead of “Hacked” next time, at first read, I had the impression those network cameras were hacked again for DDOS purposes

    Agreed — thought they got hacked again.

    Getting a full open source firmware image would make this insanely popular.

  8. James
    January 18th, 2017 at 02:28 | #8

    @ee
    I’m waiting on one of these to get something like openwrt ported to it. I have some Foscams, and they’re great but there’s changes I’d love to make to them but can’t. For one thing, those cameras have to be used with IE to view the feed or make some changes in a web browser. Firefox/Chrome won’t show video or even all of the settings you can change. It uses an ActiveX control. That’s silly in these days when HTML5 could be used to replicate any features that needed ActiveX to run. There’s a Raspberry Pi with a Pi camera, but that has no ability to see in the dark or any kind of ability to point the camera around remotely.

  9. Bill
    January 18th, 2017 at 10:59 | #9

    The 720p camera is $30 on Amazon all day every day.. I have five of them, all “hacked” with this firmware to remove the cloud features and just enable RTSP.

  10. February 3rd, 2017 at 04:37 | #10

    I think there is a major error /misleading in the article (about line 5), this camera’s have NO OPTICAL ZOOM at all !!
    Just even mentioning ‘zoom’ is misleading.

    What I read on this amazon links, all have 4X digital zoom. Which is useless.

    Please update this article.

  11. February 3rd, 2017 at 04:46 | #11

    one more thing that is wrong, IR LEDs
    720P = 8pcs 940nm infrared LED
    1080P = 11 pcs 940nm infrared LED

    Which is basically quite right, the higher resolution needs more light.

  12. February 3rd, 2017 at 09:11 | #12

    @Tido
    On GearBest for 720p model:
    “4X Zoom: Simply double-click to activate the 4x optical digital zoom to focus on small details”. That’s quite conflicting mixing digital and optical.

    1080p model:
    “Built-in 2pcs 850nm LEDs”

  13. Prashant
    April 20th, 2017 at 23:07 | #13

    I tried to block all outside traffic of cameras by blocking these camera IPs in my firewall. But then I noticed that when internet connection is blocked, cameras stop recording videos on SD cards (happens after few hours) Have any one faced this issue?

  14. April 21st, 2017 at 09:41 | #14

    @Prashant
    Have you already run the scripts to disable cloud service?

    • Prashant
      April 22nd, 2017 at 18:07 | #15

      No, I did not disable cloud service, I just blocked internet access to camera ip in my firewall. Next week I am planning to try disabling cloud service.

  15. Prashant
    April 21st, 2017 at 15:29 | #16

    @cnxsoft
    Not yet, i did not try this script. I was trying to block complete internet access for cameras. I am not sure how much we can trust such chinese cameras in terms of security over internet.

  1. No trackbacks yet.